nexusmem 0.4.0 → 0.5.0

package/CHANGELOG.md

@@ -9,6 +9,23 @@ built from, matched by publish timestamp: `v0.1.0` → `67a4776`, `v0.1.1` → `
 
 ## [Unreleased]
 
+## [0.5.0] — 2026-08-17
+
+### Added
+
+- **`nexusmem forget <value>`: permanent, value-keyed deletion.** The finer-grained complement to
+  `sync --prune-source` (which only deletes at the whole-collector-source granularity): forgets one
+  exact string or `--regex` pattern, deleting every node it currently matches *and* writing a
+  standing deny-list entry so the value can never be re-ingested — closing the one gap an external
+  source-level review flagged as its most serious finding: the append-only shell-hook log (and a
+  full transcript re-read) are untouched by any prune, so `sync --rebuild` used to resurrect exactly
+  what had just been deleted. Every removal leaves a hash-only tombstone (never the forgotten
+  content itself — `body`/`title` are stored as sha256 only) and the whole operation writes one
+  `mutation_audit` row, whether or not anything matched. Dry-run by default, matching
+  `--prune-source`'s convention exactly; `--yes` confirms; `--list` shows active entries. Permanent
+  in v0 — no `--remove`, matching the existing irreversible framing of `--prune-source`/`--rebuild`.
+  See `docs/forget-mechanism.md`.
+
 ## [0.4.0] — 2026-08-16
 
 ### Added
@@ -320,7 +337,8 @@ First public release.
   there is no local-model summarization pass, and the conversation collector has never been audited
   for the stale-node bug that was found and fixed in the docs collector.
 
-[Unreleased]: https://github.com/yaminbkk/NexusMem/compare/v0.4.0...HEAD
+[Unreleased]: https://github.com/yaminbkk/NexusMem/compare/v0.5.0...HEAD
+[0.5.0]: https://github.com/yaminbkk/NexusMem/compare/v0.4.0...v0.5.0
 [0.4.0]: https://github.com/yaminbkk/NexusMem/compare/v0.3.3...v0.4.0
 [0.3.3]: https://github.com/yaminbkk/NexusMem/compare/v0.3.2...v0.3.3
 [0.3.2]: https://github.com/yaminbkk/NexusMem/compare/v0.3.1...v0.3.2

package/README.md

@@ -318,10 +318,15 @@ optimizing, and it is somebody else's process.
   against this repo's own memory, switching to the joint cap moved the section that answered the
   question up in three of them (the rationale section for "why BM25 before vector search" went from
   rank 4 to rank 1) and displaced no query's correct top hit.
+- **`forget` is per-repository, not global.** Its deny-list lives in the one `.nexusmem/memory.db` it
+  ran against (plus that repo's stale prior identities, same scope `--prune-source` already uses). A
+  value that leaked into shell history from several repositories needs `forget` run once per repo —
+  there is no shared, machine-wide deny-list across every project you have synced.
 
 ## Commands
 
-`init`, `sync`, `query <text>`, `status`, `projects`, `mcp`, and `hook install|remove|status`.
+`init`, `sync`, `query <text>`, `status`, `projects`, `mcp`, `forget <value>`, and
+`hook install|remove|status`.
 
 There are also five dry-run previews (`scan-git`, `scan-diff`, `scan-shell`, `scan-docs`,
 `scan-conversation`)
@@ -334,6 +339,14 @@ transcript source in for one run without persisting it, `--no-embed` skips the v
 `--link-failures` builds the failure → fix chains described above, and `--rebuild` drops the
 project's nodes and re-ingests from scratch.
 
+`sync --prune-source <name>` deletes an entire collector source (e.g. `shell:pwsh`); `forget <value>`
+is the finer-grained complement — it deletes every node matching one exact string (or `--regex`
+pattern) *and* writes a standing deny-list entry so the value can never be re-ingested, even by a
+later `sync --rebuild` re-reading the append-only shell-hook log or a full transcript scan. Every
+removal leaves a hash-only tombstone, never the forgotten content itself. Both are dry-run by
+default; `--yes` confirms. See [`docs/forget-mechanism.md`](docs/forget-mechanism.md) for why this
+exists.
+
 ## Recall across projects
 
 `query --all-projects` searches every repository you have run NexusMem in, not just the current one,